© 2003 - 2005 Sipura Technology, Inc
Proprietary (See Copyright Notice on Page 2)
35
Flow Step
Step Description
SEC-PRV-1
Secure Provisioning – Initial Configuration
The initial device-unique CFG file should be targeted to each SPA by
compiling the CFG file with the spc “--target” option. This provides an initial
level of encryption which does not require the exchange of keys.
The initial device-unique CFG file should reconfigure the profile parameters to
enable stronger encryption, by programming a 256-bit encryption key, and
pointing to a randomly generated TFTP directory. For example, the CFG file
might contain:
Profile_Rule “[--key $A] tftp.callme.com/profile/$B/spa2000.cfg”;
GPP_A “8e4ca259…”; # 256 bit key
GPP_B “Gp3sqLn…”; # random CFG file path directory
SEC-PRV-2
Secure Provisioning – Full Configuration
The subsequent profile resync operations retrieve 256-bit encrypted CFG files,
which maintain the SPA in a state synchronized to the provisioning server.
All remaining SPA parameters are configured and maintained through this
strongly encrypted profile. The encryption key and random directory location
can be changed periodically for extra security.
The SPA provisioning flow is diagramed in the following figure:
